Web Scraping APIs

What Is a CAPTCHA Solver?

What Is a CAPTCHA Solver? — conceptual illustration
On this page

A CAPTCHA solver is software that automatically completes CAPTCHA challenges for an automated client. A CAPTCHA is the "prove you're human" test a site shows you — clicking pictures of traffic lights, or a hidden background check. The solver takes that challenge from a site, works it out using AI models, browser automation, or real people paid to solve them, and hands back a token — a pass-code the site accepts as proof of being human. That lets a scraper, bot, or test script complete the challenge without anyone clicking anything by hand.

Quick facts

Also known asCAPTCHA automation, automated CAPTCHA handling, anti-CAPTCHA
Common types solvedreCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile, FunCaptcha, image CAPTCHAs
Primary use caseKeeping scrapers, automated tests, and account workflows running
Typical pricing$1–$3 per 1,000 solves (machine), $1–$2 per 1,000 (human)
Risk levelMedium — must respect site terms; widely used for public-data scraping and QA

How CAPTCHA solvers work

Most solvers work in three steps. First, the scraper spots a CAPTCHA on the page (or knows to expect one) and reads off the details the challenge needs — the site key (the public ID that ties the challenge to that website), the page URL, and which type of CAPTCHA it is. Second, it sends those details to a solving backend: this can be an in-house AI model trained on millions of past challenges, a network of low-cost human workers, or a hybrid that passes the hard ones to humans. Third, the backend returns a token (a long, meaningless-looking string) that the scraper pastes into the page's form or attaches to its next request. The target site checks that token with its CAPTCHA provider, sees a passing score, and lets the request through. For invisible CAPTCHAs like reCAPTCHA v3 or Turnstile — which judge you silently instead of asking you to click anything — the solver often runs the challenge inside a real browser fingerprint (the unique profile of signals a browser gives off), so the token carries trusted behavioral and TLS signals. TLS is the encryption layer behind https, and its handshake leaves a fingerprint of its own.

Why CAPTCHA solvers matter for web scraping

CAPTCHAs are the most visible layer of bot defense, and any non-trivial scraping project will run into them. Without a solver, one CAPTCHA-protected page can stall a job forever. With one, the scraper completes the challenge automatically and keeps going. Solvers also matter because they let you scale: solving 50,000 challenges by hand is not a workflow, but solving them at $2 per thousand is just a line item on a bill. The catch is that solvers are not a magic fix — they handle the challenge itself, but if your IP, headers, or TLS fingerprint still look automated, the site will simply throw another challenge at you a few requests later. A solver is one part of a working scraping setup, not the whole thing.

Common implementations

Solvers come in three common shapes. Pure-API services (2Captcha, Anti-Captcha, CapSolver) take a job over HTTP and return a token; you wire them into your own code. Browser-automation libraries (Playwright/Puppeteer plugins — tools that drive a real browser from code) inject the solver into a live browser session and click through challenges for you. Full scraping APIs like Scrappey fold the solver into the same request that fetches the page — you send a URL, and the API handles proxies, JS rendering, fingerprinting, and CAPTCHAs in one call, returning the finished HTML or JSON. Most production scrapers end up using either the third option or a mix of the first two.

Limitations and alternatives

Solvers cost real money per challenge, so a poorly-built scraper that trips a CAPTCHA on every request gets expensive fast. They also add delay — solving a Turnstile challenge can take 8–20 seconds. The best first move is to reduce how often a CAPTCHA appears at all: use quality residential proxies, a coherent browser fingerprint, a moderate request rate, and reused session cookies so repeated requests share one consistent session rather than appearing as many strangers. When you do hit a CAPTCHA, fall back to the solver. For sites that gate every single request behind one, switching to an official API (if the site offers one) or a managed scraping endpoint is almost always cheaper than solving thousands of challenges an hour.

Code example

python
import requests

resp = requests.post(
    'https://publisher.scrappey.com/api/v1?key=YOUR_API_KEY',
    json={
        'cmd': 'request.get',
        'url': 'https://example.com/protected',
        'autoparse': True
    }
)

# CAPTCHA + proxy + fingerprinting handled server-side
html = resp.json()['solution']['response']

Related terms

Concept map

How CAPTCHA Solver connects

The terms most directly tied to this one. Hover a node to see its neighbours, click to preview, drag to rearrange.

0 terms · 0 connections
You are here · Web Scraping APIs
Building map…

Frequently asked questions

Are CAPTCHA solvers legal?

Using a solver on public data, your own accounts, or for QA testing is generally legal in most places. Using one against a login you don't own, to break a site's terms of service in a way that's contractually enforceable, or to commit fraud is not. The tool itself is neutral; what matters is what you do with it.

How accurate are CAPTCHA solvers?

For image CAPTCHAs and reCAPTCHA v2, solve rates from quality providers sit in the 90–99% range. Turnstile and reCAPTCHA v3 are harder because they score your behavior, not just whether you got the puzzle right — so accuracy depends as much on the surrounding fingerprint as on the solver itself.

How much does CAPTCHA solving cost?

Machine solvers typically charge $1–$3 per 1,000 solves. Human solvers cost about the same but are slower. Integrated scraping APIs bundle the cost into their per-request price, which is usually cheaper than solving at scale yourself.

Can sites detect that a CAPTCHA solver was used?

Not directly — the token a solver returns looks identical to one a human would produce. But sites can spot the context around it: an IP with no browsing history, a missing TLS fingerprint, or a suspiciously perfect 200ms response time are all stronger giveaways than the token itself.

Last updated: 2026-05-31